CVE-2026-94204

HighCVSS 7.5/10Last modified Sep 29, 2026

Description

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Sep 29, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-942059.8Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request CVE-2026-942066.3Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an CVE-2026-94217.3A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of CVE-2026-942103.5A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tic CVE-2026-942112.4A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/D CVE-2026-942126.4Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user CVE-2026-942134.9A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occu CVE-2026-942144.3A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler. CVE-2026-942155.5A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API CVE-2026-942164.3A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX. This vulnerability affects unknown code of the file /authorize of CVE-2026-942173.5A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when proc CVE-2026-942183.1A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an